Re-sign composer metadata when drupal.org metadata is updated
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3582535. -->
Reported by: [star-szr](https://www.drupal.org/user/1167326)
>>>
<h3 id="summary-problem-motivation">Problem/Motivation</h3>
<p>If a new version of a package is released, we normally expect the composer metadata JSON to increase in size with each new release.</p>
<p>With some packages, we are seeing an invalid sha256 hash error for composer metadata JSON targets, for example:</p>
<pre> [Tuf\Exception\Attack\InvalidHashException] <br> Invalid sha256 hash for files/packages/8/p2/drupal/lti_tool_provider.json</pre><p>In these cases, the expected size of the composer metadata JSON either stays the same or decreases (so we aren't seeing <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/infrastructure/-/work_items/3582527" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/infrastructure/-/work_items/3582527</a></span> because we are within the limit).</p>
<h4 id="summary-steps-reproduce">Steps to reproduce</h4>
<p>To set up, see steps to reproduce in <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/infrastructure/-/work_items/3579174" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/infrastructure/-/work_items/3579174</a></span>. To figure out the hash of a given target, see <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/infrastructure/-/work_items/3579174" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/infrastructure/-/work_items/3579174</a></span>.</p>
<p>Test requiring any of:</p>
<p><code>drupal/better_field_descriptions</code><br>
<code>drupal/ckeditor</code><br>
<code>drupal/cms_blog</code><br>
<code>drupal/lti_tool_provider</code><br>
<code>drupal/mailjet_webform_subscription</code><br>
<code>drupal/shariff</code><br>
<code>drupal/smart_ip</code><br>
<code>drupal/views_linkarea</code><br>
<code>drupal/weight</code></p>
<p>Expected result: Requiring the package succeeds, assuming there is a valid version matching your Drupal install.</p>
<p>Actual result is an error similar to:</p>
<pre> [Tuf\Exception\Attack\InvalidHashException]<br> Invalid sha256 hash for files/packages/8/p2/drupal/lti_tool_provider.json</pre><h3 id="summary-proposed-resolution">Proposed resolution</h3>
<p>Our hypothesis is that the only way that the composer metadata can have a different hash but not increase in size would be through changes to drupal.org metadata, since it appears that sections such as <code>author</code> are populated from drupal.org metadata.</p>
<p>If this is in fact the case, then a potential resolution would be to send the new composer metadata for signing when drupal.org metadata is updated.</p>
<h3 id="summary-remaining-tasks">Remaining tasks</h3>
<p>TBD</p>
<h3 id="summary-ui-changes">User interface changes</h3>
<p>TBD</p>
<h3 id="summary-api-changes">API changes</h3>
<p>TBD</p>
<h3 id="summary-data-model-changes">Data model changes</h3>
<p>TBD</p>
> Related issue: [Issue #3579174](https://www.drupal.org/node/3579174)
issue